I'm trying to get an OpenBSD server to authenticate users using the same LDAP server the rest of my home network uses. While 'getent password' lists the users from the LDAP server as expected, I cannot log in as any of them.
I have following n my /etc/login.conf:
# # ldap # ldap:\ :auth=-ldap:\ :x-ldap-server=kaitain.cory.albrecht.name,389,plain:\ :x-ldap-basedn=ou=People,dc=cory,dc=albrecht,dc=name:\ :x-ldap-filter=(&(objectclass=posixAccount)(uid=%u)):\ :tc=default:
But when I try to test a user, I get the following:
root@opensecrets:/etc# /usr/libexec/auth/login_-ldap -d -s login cory ldap Password: load_ssl_certs says: cacert none cacertdir none usercert none userkey none parse_server_line buf = host parse_server_line port == NULL, will use default parse_server_line mode == NULL, will use default host host, port 389, version 3 setting cert info clearing ssl set ldap_open(host, 389) failed host failed, trying alternates ldap_open failed reject
That plus these lines from the log
Dec 17 15:30:19 <auth.warn> opensecrets.cory.albrecht.name opensecrets login_ldap: ldap_open(host, 389) failed Dec 17 15:30:19 <auth.warn> opensecrets.cory.albrecht.name opensecrets login_ldap: ldap_open failed
make me think some how /etc/login.conf's ldap section is not being read. Changing the 389 for the port to 38389 in login.conf makes no change to the output of the faked/testing login.
I'm completely stumped as to what to do to determine what is causing login.conf to not be fully parsed and I'm kind of hoping it's something easy at which I will be terribly embarrassed for forgetting it.